registry / @socketsecurity/cli / 1.2.1
@socketsecurity/cli@1.2.1
CLI for Socket.dev
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found a user-invoked CLI without an npm install lifecycle hook or concrete malicious behavior. Observed dynamic execution is within bundled terminal and validation libraries.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs one of the package command-line entrypoints.
Impact
No unconsented install-time execution, credential export, persistence, or destructive behavior was identified.
Mechanism
The launcher starts the bundled CLI; the wrapper path requires an explicit command-line flag.
AI rationale
Static inspection found a user-invoked CLI without an npm install lifecycle hook or concrete malicious behavior. Observed dynamic execution is within bundled terminal and validation libraries.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes command-line entrypoints and contains no registry install lifecycle hook.
- The main launcher starts the bundled CLI with inherited arguments and environment.
- The post-install wrapper is reached only when the CLI receives an explicit --postinstall argument.
- Dynamic functions in bundled dependencies compile terminal formatting or schema-validation code.
- The required Maven artifact is a Java archive with a manifest entry.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
17 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
2 Critical9 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighSemantic Analysis Limiteddist/vendor.js
Medium
Affected versions and remediation
This report applies to @socketsecurity/cli@1.2.1.
See all versions of @socketsecurity/cli for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli@1.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.